Is Prime Connect - Message Sender safe?

Medium risk

Prime Connect - Message Sender sends WhatsApp phone-number and location analytics to Google Analytics.

When WhatsApp Web loads, the content script builds analytics labels from the stored WhatsApp number plus plan type and plan duration, then sends them with city, region, country, and dial code to Google Analytics. The location fields are populated by a GeoJS IP geolocation request on install, and the analytics payload includes a persistent client ID from Chrome storage.

escuderohuillcamasccoevaristov3.1.108Chrome Web Store
45Risk
Who publishes it

escuderohuillcamasccoevaristo - 3 other listings from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
escuderohuillcamasccoevaristo

Same store account

3 other listings published from this account, 12k+ users between them. 1 of them carries a finding.

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

izipay.pe
Also called by 2 other listings, including WAPI FREE - Free IA Web

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Prime Connect links your WhatsApp number and location to Google Analytics

Prime Connect reads your WhatsApp account number from WhatsApp Web's own storage and sends it, joined with your plan details and location, to Google Analytics on every visit.

Confirmed with a planted test number.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open WhatsApp Web with Prime Connect installed.

The extension did this

The content script reads your WhatsApp account number from the page's own storage and sends it, with your city and country, to Google Analytics.

Fields observed in the Google Analytics event
  • Tracking label
    51987654321 Premium 30d (illustrative)

    Combines your WhatsApp number with your subscription plan and its duration into one identifier.

  • City / region / country
    Lima, Lima, Peru

    Approximate location resolved from your IP address when the extension was installed.

  • Dial code
    +51

    Country calling code paired with the resolved location.

  • Client ID
    550e8400-e29b-41d4-a716-446655440000

    A random ID stored by the extension that ties every event to the same install over time.

The code that does this

Reading the number and building the tracked event

Readable version

getTrackLabel / getTrackLocation / trackSystemEvent

contentmin.js
// Builds the label sent with every analytics event: the user's WhatsApp// number joined with their plan type and plan duration.function getTrackLabel() {  try {    return [myWhatsAppNumber, planType, planDuration].join(" ").trim();  } catch {    return "";  }}// Adds the install-time geolocation (from get.geojs.io) to the event,// unless it's still the un-resolved default.function getTrackLocation() {  return locationInfo.default    ? {}    : {        city: locationInfo.city,        region: locationInfo.region,        country: locationInfo.country,        dial_code: locationInfo.dialCode,      };}// Fired on every WhatsApp Web page load (see "whatsapp_visit" in init()).function trackSystemEvent(eventName, track = "") {  trackGenericEvent(eventName, { type: "event", track });}// Merges the phone-number label, location, and app context into one// Google Analytics event and hands it to GoogleAnalytics.trackEvent().function trackGenericEvent(eventName, extraParams) {  const label = getTrackLabel();  const params = {    ...getTrackLocation(),    ...getTrackContext(),    ...extraParams,  };  GoogleAnalytics.trackEvent(eventName, { label, ...params });}

fireEvent sends the payload to Google Analytics

codegoogle.js
async function fireEvent(eventName, params = {}) {  // Attach a session id and a default engagement time to every event.  params.session_id ||= await this.getOrCreateSessionId();  params.engagement_time_msec ||= GA_CONFIG.DEFAULT_ENGAGEMENT_TIME_MSEC;  // POST straight to Google's Measurement Protocol collector, with a  // persistent per-install client_id read from chrome.storage.local.  const endpoint = this.debug ? GA_CONFIG.GA_DEBUG_ENDPOINT : GA_CONFIG.GA_ENDPOINT;  await fetch(    `${endpoint}?measurement_id=${GA_CONFIG.MEASUREMENT_ID}&api_secret=${GA_CONFIG.API_SECRET}`,    {      method: "POST",      body: JSON.stringify({        client_id: await this.getOrCreateClientId(),        events: [{ name: eventName, params }],      }),    }  );}
Captured request
POSThttps://www.google-analytics.com/mp/collect?measurement_id=<redacted>&api_secret=<redacted>

HTTP 204 No Content (standard Measurement Protocol response).

Body
{  "client_id": "550e8400-e29b-41d4-a716-446655440000",  "events": [    {      "name": "whatsapp_visit",      "params": {        "label": "51987654321 Premium 30d",        "city": "Lima",        "region": "Lima",        "country": "Peru",        "dial_code": "+51",        "init_store_type": "md",        "whatsapp_version": "2.3000.1",        "extension_version": "3.1.108",        "engagement_time_msec": 100      }    }  ]}
Where the data ends up
    • www.google-analytics.com

    Receives the WhatsApp number label, plan details, and location fields via the Measurement Protocol; operated by Google.

    • get.geojs.io

    Resolves the extension's install-time IP address to a city, region, and country used in later analytics events.

Where it sends data

Destinations our analysis observed Prime Connect - Message Sender contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.google-analytics.comwidely used

    Prime Connect - Message Sender sends data to www.google-analytics.com. A widely used service: 346 other extensions we have analysed send data here.

  • get.geojs.io

    Prime Connect - Message Sender sends data to get.geojs.io. 4 other extensions we have analysed send data here.

Updated 30 September 2026lpkcglgkpkloheddkmehdapeclclnecm